Application Security Engineer

These Application Security Engineers will be focused on a security remediation initiative addressing an existing backlog of hardcoded secrets and credential exposure findings across GitHub source-code repositories. Automated detection is already in place through GitHub Advanced Security (Enterprise) Secret Scanning. The focus is not building a new detection solution, but taking existing findings through investigation, validation, remediation coordination, documentation, and final disposition. Additionally, these engineers will partner with application security, software development, platform engineering, application owners, and other stakeholders to assess risk, determine ownership, coordinate remediation, and drive findings to documented closure. Successful candidates must be able to contribute meaningfully from day one., “ Review and triage automated secret-scanning findings generated through GitHub Advanced Security. “ Investigate GitHub repositories and repository history to determine validity, ownership, environment, privilege level, and potential risk. “ Determine whether exposed credentials remain active and identify the appropriate remediation path. “ Partner with development, platform engineering, application owners, and security stakeholders to drive remediation. “ Coordinate credential revocation, rotation, secure replacement, and removal from source code, then validate successful closure.

Application Security Engineer | Confidential Job Profile “ Document false positives, test credentials, revoked credentials, accepted risks, and other outcomes with consistent, auditable rationale. “ Escalate high-risk, privileged, production, externally exposed, or potentially misused credentials through established processes. “ Use the GitHub REST API and scripting to retrieve, enrich, correlate, assign, update, and report on findings at scale. “ Work with existing credential-validation scripts and modify, extend, or improve automation where useful. “ Manage a large remediation backlog independently and drive findings through documented closure. Conduct post-event reviews for material issues and implement corrective actions to prevent recurrence.

Applications Security, Software Engineering, Technical Recruiting, Source Code/Configuration Management (SCM), Bash Scripting, Python Programming/Scripting Language, Windows PowerShell, Scripting (Scripting Languages), GitHub, Git, “ 3+ years of hands-on application security experience; general cybersecurity alone will not be sufficient, as the hiring manager is specifically targeting individuals with application security experience specifically “ Experience investigating and remediating security findings involving hard-coded credentials/secrets within source code repositories. “ Strong scripting/automation experience with PowerShell, Bash and/or Python; experience with at least two of these is a requirement “ Strong Git/GitHub knowledge and experience working with engineering teams on remediation projects

Top Soft Skills “ Ability to work effectively across multiple teams and personalities within a large engineering “ Comfortable engaging directly with internal software engineering stakeholders to drive findings through resolution “ Strong follow-through and ability to work independently manage work within a short, project-based engagement, “ 3+ years of hands-on Application Security experience in an AppSec or DevSecOps environment. “ Strong understanding of secrets exposure, credential risk, secure validation, revocation/rotation, and secrets-management practices. “ Strong knowledge of GitHub and Git source control, including repositories, branches, commits, pull requests, permissions, and repository history. “ Practical experience integrating with or working through GitHub REST APIs. “ Hands-on scripting experience with at least two of the following strongly preferred: PowerShell, Bash, Python. “ Ability to understand, modify, and extend existing scripts rather than relying solely on prebuilt tooling. “ Ability to prioritize a large, potentially ambiguous remediation backlog and drive findings to documented closure. “ Strong written/verbal communication and the ability to work directly with software engineers, platform teams, and technical stakeholders. “ High attention to detail and sound judgment when handling sensitive security information. “ Ability to work independently and hit the ground running in a short-duration engagement., “ Hands-on experience with GitHub Advanced Security (Enterprise) and Secret Scanning. “ Experience remediating hard-coded secrets or exposed credentials within source-code repositories. “ Familiarity with AWS and Azure security environments, including AWS Secrets Manager and Azure Key Vault concepts. “ Experience with CI/CD pipelines, cloud identity services, security ticketing, and governance workflows. “ Familiarity with cloud access keys, PATs, OAuth credentials, SSH/private keys, database credentials, and certificates. “ Experience with AppSec remediation metrics, backlog reporting, or workflow automation. “ Experience partnering across large software engineering organizations.

We offer competitive compensation and comprehensive benefits, including medical, dental, vision, and retirement options.

TalentBurst is an equal opportunity employer committed to an inclusive and diverse workforce.

At TalentBurst, we deliver more than talent, we deliver outcomes. We partner with you to move quickly and connect you to opportunities aligned with your skills and long term growth.

Backed by precision, transparency, and results, we connect top talent with leading organizations through trusted partnerships.